feature: the OpenID Provider has the client credentials and device authorization grants, public clients, and service accounts as resources with roles and scopes in JWT access tokens.

debian-package/src/usr/share/bash-completion/completions/vpn-router-role.bash

@@ -0,0 +1,94 @@
+# bash completion for vpn-router-role                                  -*- shell-script -*-
+
+# The service accounts, the users, the groups and the roles of a resource of the router's directory, read as root;
+# nothing for other users.
+_vpn_router_role_resources()
+{
+    vpn-router-user --json list 2>/dev/null |
+        python3 -c 'import json, sys; print("\n".join(user["name"] for user in json.load(sys.stdin)["users"] if user["service"]))' 2>/dev/null
+}
+
+_vpn_router_role_accounts()
+{
+    vpn-router-user --json list 2>/dev/null |
+        python3 -c 'import json, sys; print("\n".join(user["name"] for user in json.load(sys.stdin)["users"]))' 2>/dev/null
+}
+
+_vpn_router_role_groups()
+{
+    vpn-router-group --json list 2>/dev/null |
+        python3 -c 'import json, sys; print("\n".join(group["name"] for group in json.load(sys.stdin)["groups"]))' 2>/dev/null
+}
+
+_vpn_router_role_names()
+{
+    vpn-router-role --json list "$1" 2>/dev/null |
+        python3 -c 'import json, sys; print("\n".join(role["name"] for role in json.load(sys.stdin)["roles"]))' 2>/dev/null
+}
+
+_vpn_router_role()
+{
+    local cur prev words cword split
+    _init_completion -s || return
+
+    # The command is the first word that is not an option; the arguments are the words after it but option values.
+    local i command='' args=0 resource=''
+    for ((i = 1; i < cword; i++)); do
+        if [[ -z $command ]]; then
+            [[ ${words[i]} != -* ]] && command=${words[i]}
+            continue
+        fi
+        case ${words[i]} in
+            --description | --group | --account) ((i++)) ;;
+            -*) ;;
+            *)
+                ((args == 0)) && resource=${words[i]}
+                ((args++))
+                ;;
+        esac
+    done
+
+    if [[ -z $command ]]; then
+        if [[ $cur == -* ]]; then
+            COMPREPLY=($(compgen -W '--json --help' -- "$cur"))
+        else
+            COMPREPLY=($(compgen -W 'list add remove member-add member-remove' -- "$cur"))
+        fi
+        return
+    fi
+
+    case $prev in
+        --group)
+            COMPREPLY=($(compgen -W "$(_vpn_router_role_groups)" -- "$cur"))
+            return
+            ;;
+        --account)
+            COMPREPLY=($(compgen -W "$(_vpn_router_role_accounts)" -- "$cur"))
+            return
+            ;;
+        --description)
+            return
+            ;;
+    esac
+    $split && return
+
+    if [[ $cur == -* ]]; then
+        local options='--help'
+        case $command in
+            add) options+=' --description' ;;
+            member-add | member-remove) options+=' --group --account' ;;
+        esac
+        COMPREPLY=($(compgen -W "$options" -- "$cur"))
+        return
+    fi
+
+    # The resource, then the role, which add takes new.
+    if ((args == 0)); then
+        COMPREPLY=($(compgen -W "$(_vpn_router_role_resources)" -- "$cur"))
+    elif ((args == 1)) && [[ $command != @(list|add) ]]; then
+        COMPREPLY=($(compgen -W "$(_vpn_router_role_names "$resource")" -- "$cur"))
+    fi
+} &&
+    complete -F _vpn_router_role vpn-router-role
+
+# ex: filetype=sh

debian-package/src/usr/share/bash-completion/completions/vpn-router-user.bash

@@ -13,6 +13,14 @@ _vpn_router_user_groups()
         python3 -c 'import json, sys; print("\n".join(group["name"] for group in json.load(sys.stdin)["groups"]))' 2>/dev/null
 }
 
+# The scopes of the resources, <resource>:<scope>, read as root.
+_vpn_router_user_scopes()
+{
+    vpn-router-user --json list 2>/dev/null |
+        python3 -c 'import json, sys; print("\n".join(user["name"] + ":" + scope for user in json.load(sys.stdin)["users"]
+                                                       for scope in user.get("resource_scopes", [])))' 2>/dev/null
+}
+
 _vpn_router_user()
 {
     local cur prev words cword split
@@ -30,7 +38,8 @@ _vpn_router_user()
         fi
         case ${words[i]} in
             --first-name | --last-name | --email | --display-name | --description | --redirect-uri | \
-                --post-logout-redirect-uri | --allowed-group | --account) ((i++)) ;;
+                --post-logout-redirect-uri | --allowed-group | --account | --grant | --public-client | --client-scope | \
+                --resource-scope) ((i++)) ;;
             -*) ;;
             *) ((args++)) ;;
         esac
@@ -50,6 +59,21 @@ _vpn_router_user()
             COMPREPLY=($(compgen -W "$(_vpn_router_user_groups)" -- "$cur"))
             return
             ;;
+        --grant)
+            COMPREPLY=($(compgen -W 'client_credentials device_code' -- "$cur"))
+            return
+            ;;
+        --public-client)
+            COMPREPLY=($(compgen -W 'yes no' -- "$cur"))
+            return
+            ;;
+        --client-scope)
+            COMPREPLY=($(compgen -W "$(_vpn_router_user_scopes)" -- "$cur"))
+            return
+            ;;
+        --resource-scope)
+            return
+            ;;
         --account)
             # The local accounts console --account takes: a uid from 1000 to 19999, not nobody.
             COMPREPLY=($(compgen -W "$(getent passwd | awk -F: '$3 >= 1000 && $3 < 20000 && $1 != "nobody" { print $1 }')" -- "$cur"))
@@ -65,9 +89,9 @@ _vpn_router_user()
         local options='--help'
         case $command in
             add) options+=' --first-name --last-name --email --service --display-name --description --redirect-uri
-                --post-logout-redirect-uri --allowed-group' ;;
+                --post-logout-redirect-uri --allowed-group --grant --public-client --client-scope --resource-scope' ;;
             update) options+=' --first-name --last-name --email --display-name --description --redirect-uri
-                --post-logout-redirect-uri --allowed-group' ;;
+                --post-logout-redirect-uri --allowed-group --grant --public-client --client-scope --resource-scope' ;;
             console) options+=' --posix --account --off' ;;
         esac
         COMPREPLY=($(compgen -W "$options" -- "$cur"))